registry / @clerk/ui / 1.24.1

@clerk/ui@1.24.1

Internal package that contains the UI components for the Clerk frontend SDKs

AI Security Review

scanned 11d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a Clerk React UI bundle with user-invoked authentication, organization, billing, API-key, and dev prompt flows.

Static reason

One or more suspicious static signals were detected.

Trigger

Application imports or renders @clerk/ui components, or explicitly imports @clerk/ui/register.

Impact

Expected Clerk UI behavior; no persistence, credential harvesting, lifecycle mutation, or unauthorized exfiltration found.

Mechanism

React UI bundle and Clerk SDK method calls

Rationale

Static inspection shows a published Clerk UI component package with no lifecycle hooks and no source evidence of malware primitives beyond browser UI actions aligned with authentication/product features. Scanner hits for network, protestware-like text, and secrets are explained by docs/dashboard links and UI flows for backup codes, TOTP, and API keys.

Evidence

package.jsonregister/index.mjsregister/index.cjsdist/index.jsdist/entry.jsdist/server.jsdist/components/UserProfile/MfaBackupCodeList.jsdist/components/SessionTasks/tasks/TaskChooseOrganization/CreateOrganizationScreen.jsdist/no-rhc/components/devPrompts/KeylessPrompt/index.js

Network endpoints5

dashboard.clerk.com/~/organizations-settingsclerk.com/docs/guides/organizations/overviewdashboard.clerk.com/last-activego.clerk.com/componentssolana.com/solana-wallets

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json exports only dist/register entries and has no install/preinstall/postinstall lifecycle hooks.
register/index.mjs and register/index.cjs only import React packages and set globalThis.__clerkSharedModules.
dist/index.js, dist/entry.js, and dist/server.js export ClerkUI/ui objects; no install-time behavior.
Search found no fs, child_process, native binary, wasm, shell script, or AI-agent control-surface writes.
Network/browser APIs are UI-aligned: dashboard/docs links, organization logo fetch, Clerk environment/resource methods, and user-triggered window.open.
Secret-pattern hits are UI text for backup codes/TOTP/API-key display/copy flows, not hardcoded credentials or exfiltration.

Behavioral surface

Source

ChildProcessCryptoNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,504 file(s), 9.31 MB of source, external domains: accounts.google.com, api.mainnet-beta.solana.com, clerk.com, dashboard.clerk.com, fonts.googleapis.com, fonts.gstatic.com, github.com, go.clerk.com, img.clerk.com, img.clerkstage.dev, img.lclclerk.com, reactjs.org, schemas.xmlsoap.org, solana.com, solanamobile.com, stripe.com, www.w3.org

Source & flagged code

3 flagged

dist/ui-common_ui_2bed30_1.24.1.jsView file

Lines 1-34javascript

1"use strict";(globalThis.rspackChunk_clerk_ui=globalThis.rspackChunk_clerk_ui||[]).push([[6666],{5047(e,t,r){var o,n,i=r(9701);function a(){return(a=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var r=arguments[t];for(var o in r)({}).hasOwnProperty.call(r,o)&&(e[o]=r[o])}return e}).apply(null,arguments)}r.d(t,{},{A:function(e){return i.createElement("svg",a({fill:"currentColor",xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 36 24"},e),o||(o=i.createElement("circle",{cx:18,cy:12,r:11.5,fillOpacity:.1,strokeOpacity:.4,stroke:"currentColor",strokeDasharray:"2 ...

2-webkit-print-color-adjust: exact !important;

3color-adjust: exact !important;

4print-color-adjust: exact !important;

5}`),r.contentDocument&&r.contentWindow&&(r.contentDocument.body.innerHTML=t.innerHTML,r.contentWindow.print())},window.document.body.appendChild(r)})(i)}),(0,o.Y)("div",{ref:i,style:{position:"fixed",left:"-9999px",top:0,display:"none"},children:t})},h:()=>{let e=[];return{print:()=>e.forEach(e=>e()),printableProps:{onPrint:t=>e.push(t)}}}})},2575(e,t,r){r.d(t,{r:()=>c});var o=r(9763),n=r(1046),i=r(9230),a=r(8343);let l=e=>{let{value:t,id:r,...l}=e;return(0,o.Y)(i.az,{as:"span",elementDescriptor:[n.$z.providerIcon,n.$z.socialButtonsProviderInitialIcon],elementId:n.$z.socialButtonsProviderIniti ...

6 @keyframes caret-blink-animation {

7 0%, 50% {

8 opacity: 1;

9 }

10 51%, 100% {

11 opacity: 0;

12 }

13 }

14 `}),(0,o.Y)(c.so,{align:"center",justify:"center",sx:()=>({animation:"caret-blink-animation 1s infinite",pointerEvents:"none",position:"absolute",inset:0}),children:(0,o.Y)(c.az,{sx:e=>({height:e.space.$4,width:e.space.$px,backgroundColor:e.colors.$colorInputForeground})})})]})}r.d(t,{},{Ro:()=>{let{resendButton:e,onResendCode:t,isLoading:r,otpControl:n}

15 0% { transform: rotate(0deg); }

16 100% { transform: rotate(360deg); }`,i=(0,o.i7)`

17 0% {

18 opacity: 0;

19 transform: scaleY(1) translateY(-6px);

20 }

21 100% {

22 opacity: 1;

23 transform: scaleY(1) translateY(0px);

24 }

25`,a=(0,o.i7)`

26 0% {

27 opacity: 0;

28 transform: translateY(0.5rem);

29 }

30 100% {

31 opacity: 1;

32 transform: translateY(0);

33 }

34`,l=(0,o.i7)`

Long lines were clipped for display.

dist/ui-common_ui_821323_1.24.1.jsView file

Lines 1-1javascript

1"use strict";(globalThis.rspackChunk_clerk_ui=globalThis.rspackChunk_clerk_ui||[]).push([[6666],{55047(e,t,r){var n,o,a=r(59701);function i(){return(i=Object.assign?Object.assign.bind():function(e

dist/ui-common_ui_be75c0_1.24.1.jsView file

Lines 1-34javascript

1"use strict";(globalThis.rspackChunk_clerk_ui=globalThis.rspackChunk_clerk_ui||[]).push([[6666],{5047(e,t,r){var n,o,i=r(630);function a(){return(a=Object.assign?Object.assign.bind():function(e

Source & flagged code

3 flagged · loading source

dist/ui-common_ui_2bed30_1.24.1.jsView file

14patternName = generic_password severity = medium line = 14 matchedText = `}),(0,o...i7)`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui-common_ui_2bed30_1.24.1.jsView on unpkg · L14

dist/ui-common_ui_821323_1.24.1.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...}]);

Medium

Secret Pattern

Hardcoded password in dist/ui-common_ui_821323_1.24.1.js

dist/ui-common_ui_821323_1.24.1.jsView on unpkg · L1

dist/ui-common_ui_be75c0_1.24.1.jsView file

14patternName = generic_password severity = medium line = 14 matchedText = `}),(0,n...i7)`

Medium

Secret Pattern

Hardcoded password in dist/ui-common_ui_be75c0_1.24.1.js

dist/ui-common_ui_be75c0_1.24.1.jsView on unpkg · L14

Findings

6 Medium4 Low

MediumSecret Patterndist/ui-common_ui_2bed30_1.24.1.js

MediumNetwork

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/ui-common_ui_821323_1.24.1.js

MediumSecret Patterndist/ui-common_ui_be75c0_1.24.1.js

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/ui-common_ui_2bed30_1.24.1.jsView file

Lines 1-34javascript

2-webkit-print-color-adjust: exact !important;

3color-adjust: exact !important;

4print-color-adjust: exact !important;

6 @keyframes caret-blink-animation {

7 0%, 50% {

8 opacity: 1;

9 }

10 51%, 100% {

11 opacity: 0;

12 }

13 }

15 0% { transform: rotate(0deg); }

16 100% { transform: rotate(360deg); }`,i=(0,o.i7)`

17 0% {

18 opacity: 0;

19 transform: scaleY(1) translateY(-6px);

20 }

21 100% {

22 opacity: 1;

23 transform: scaleY(1) translateY(0px);

24 }

25`,a=(0,o.i7)`

26 0% {

27 opacity: 0;

28 transform: translateY(0.5rem);

29 }

30 100% {

31 opacity: 1;

32 transform: translateY(0);

33 }

34`,l=(0,o.i7)`

Long lines were clipped for display.

dist/ui-common_ui_821323_1.24.1.jsView file

Lines 1-1javascript

1"use strict";(globalThis.rspackChunk_clerk_ui=globalThis.rspackChunk_clerk_ui||[]).push([[6666],{55047(e,t,r){var n,o,a=r(59701);function i(){return(i=Object.assign?Object.assign.bind():function(e

dist/ui-common_ui_be75c0_1.24.1.jsView file

Lines 1-34javascript

1"use strict";(globalThis.rspackChunk_clerk_ui=globalThis.rspackChunk_clerk_ui||[]).push([[6666],{5047(e,t,r){var n,o,i=r(630);function a(){return(a=Object.assign?Object.assign.bind():function(e